Why Is Cyber Security Awareness Training Important

Why is cyber security awareness training important enough to measure properly? Because without indicators chosen in advance, the programme gets judged on whichever number is easiest to produce.

Worth tracking. Report rate, meaning how many people report a suspicious message rather than deleting it. Time from receipt to report. Coverage across casuals, contractors and remote staff. And whether verification actually happens on payment changes.

Flattering but weak. The click rate on simulations. It falls naturally as people learn to recognise your simulation platform rather than the underlying attack, and it says nothing about what happens with a real message.

Report rate is the better headline. A workforce that clicks occasionally and reports immediately is in much better shape than one that clicks rarely and says nothing.

The Australian Cyber Security Centre publishes guidance for organisations. This is general information rather than legal advice, and obligations vary by state and territory.

See Sentrient’s incident reporting software and cyber security course.

Summarize this data

Why is cyber security awareness training important enough to measure properly? Because without indicators chosen in advance, the programme gets judged on whichever number is easiest to produce.

Worth tracking. Report rate, meaning how many people report a suspicious message rather than deleting it. Time from receipt to report. Coverage across casuals, contractors and remote staff. And whether verification actually happens on payment changes.

Flattering but weak. The click rate on simulations. It falls naturally as people learn to recognise your simulation platform rather than the underlying attack, and it says nothing about what happens with a real message.

Report rate is the better headline. A workforce that clicks occasionally and reports immediately is in much better shape than one that clicks rarely and says nothing.

The Australian Cyber Security Centre publishes guidance for organisations. This is general information rather than legal advice, and obligations vary by state and territory.

See Sentrient’s incident reporting software and cyber security course.